Hacker News Reader

Comment by maxharris | Hacker News Reader

It's just a plain website that doesn't do anything besides give you some text and images. This is technology that has functioned just fine for decades. I don't understand why it needs SSL at all - where's the private information that might be intercepted by someone in the middle?

View on HN

SSL (well, TLS now) serves three purposes.

1. Ensuring you are getting the information the website author intends for you to get. i.e. data can’t be manipulated in transit.

2. Ensuring the information you are getting is in fact coming from the domain you are requesting it from.

3. Preventing others between you and the website from seeing the information sent back and forth.

I think you questioned the need for TLS here assuming 3 was the only purpose of TLS?

The intention isn’t about private information. What if essay text is modified in transit/injected with advertisements?

Dunno, try it!

Rather than go to all that effort of doing something illegal for an individual, it's far simpler to find prior work.

https://www.google.com/search?q=javascript+injection+by+isps

Or QUANTUM INSERT/man-on-the-side attacks.

If I lived in a country where all ISPs are allowed to inject my traffic with ads, I probably wouldn't use the Internet without a decent VPN.

The consensus among young devs these days is such a situation would be an abomination, that it's a sign of disrespect towards the visitor and that you should be publicly shamed for this.

Reply on news.ycombinator.com